Trusted Platform Modules (or “TPMs”) are trusted execution environments that are isolated from the regular operating environment of computing devices. Typically, TPMs are implemented in the form of a chip that is physically bound to a computing device. The regular computing environment may communicate with the TPM through an interface, an example of which being TPM Based Services (or “TBS”).
TPMs provide a range of functions, the most commonly used including cryptographic key generation, policy-driven key use, sealed storage, and attestation. TPMs have a region of memory called a “protected area” that contains data that cannot be read from outside the TPM, but nevertheless operations may be performed using such data. Some of the data is immutable and thus is read (but not changed) by the operation that is being performed, and some of the data is mutable and can be changed through such operations. Note that it is the operation that is being performed internal to the TPM that is reading the data. The protected data is not readable outside the TPM.
Thus, the TPM has an operational component that performs operations, and a memory component which retains protected data that cannot be read outside of the TPM. The operational speed of the TPM is limited to the capabilities of the hardware within the TPM. Also, the size of the protected area is limited to the space within the TPM.